17 // SYN cookies Because SYN cookie is stateless, it does not set up a session or do policy and route lookups upon receipt of a SYN segment. This dramatically reduces CPU and memory usage and is main advantage instead of SYN proxying. SYN cookie itself is computed ISN from first SYN packet: time, source IP and port, destination IP and port and MSS. When final ACK arrives (ISN+1) server knows to which cookie is that related. In high-end devices, the PPU ASIC chip in the security device performs the SYN cookie mechanism instead of the security device CPU. set zone untrust screen syn-flood set zone untrust screen syn-flood attack-threshold 1000 set flow syn-proxy syn-cookie

22 CoreXL This feature provides scalability of performance, according to the number of processor cores on a single machine. No change to network topology or management is required. CoreXL joins ClusterXL Load Sharing and SecureXL as part of the Check Point traffic acceleration technologies. The firewall kernel is replicated a number of times in a CoreXL gateway. Each instance or replicated copy of the firewall kernel runs on one processor core. These instances handle traffic concurrently, and each instance is a complete and independent inspection kernel. Enable via cpconfig option menu

23 CoreXL When running CoreXL on four or more processing cores, the number of kernel instances in the CoreXL post-setup configuration is one less than the number of processing cores. The remaining processing core is responsible for processing incoming traffic from the network interfaces, securely accelerating authorized packets (if Performance Pack is running) and distributing non-accelerated packets among kernel instances. #As you can see connections are balanced across CPU cores fw ctl multik stat ID Active CPU Connections Peak Yes Yes Yes Yes Yes Yes

31 Simple connection limiting - (D)DoS Deflate (D)DoS Deflate is a lightweight bash shell script designed to assist in the process of blocking a denial of service attack. It utilizes the command below to create a list of IP addresses connected to the server, along with their total number of connections. It is one of the simplest and easiest to install solutions at the software level. netstat -ntu awk '{print $5}' cut -d: -f1 sort uniq -c sort -n IP addresses with over a pre-configured number of connections are automatically blocked in the server's firewall, which can be direct iptables or Advanced Policy Firewall (APF).

36 BigIP ASM DoS Attack Prevention Latency increased by Specifies that the system considers traffic to be an attack if the latency has increased by this percentage. Latency reached Specifies that the system considers traffic to be an attack if the latency is equal to or greater than this value. Source IP-Based Client-Side Integrity Defense Checks whether a client is a legal browser or an illegal script by injecting JavaScript into responses when suspicious IP addresses are requested. URL-Based Client-Side Integrity Defense Checks whether a client is a legal browser or an illegal script by injecting JavaScript into responses when suspicious URLs are requested. Source IP-Based Rate Limiting Check to drop requests from suspicious IP addresses. Application Security Manager drops connections to limit the rate of requests to the average rate prior to the attack, or lower than the absolute threshold specified by the IP detection TPS reached setting. URL-Based Rate Limiting Check to indicate that when the system detects a URL under attack, Application Security Manager drops connections to limit the rate of requests to the URL to the average rate prior to the attack. Effective Challenge/Response authentication mechanism to differentiate attackers from normal users during DoS attack is usually JavaScript

38 BigIP LTM DoS attack prevention Reaper High-water Mark Specifies, in percent, the memory usage at which the system stops establishing new connections. Reaper Low-water Mark Specifies, in percent, the memory usage at which the system silently purges stale connections, without sending reset packets (RST) to the client. SYN Check Activation Threshold Specifies the number of new or untrusted TCP connections that can be established before the system activates the SYN Cookies. Please read following documentation for LTM DoS mitigation in detail (if needed)

39 DNS Reflection and Amplification DoS prevention Don't setup DNS server as open resolver. A DNS resolver is open if it provides recursive name resolution for clients outside of its administrative domain. DNS RRL is an experimental feature for domain name servers including CZ-NIC Knot DNS, NLNetLabs NSD, and ISC BIND9. BIND example: rate-limit { responses-per-second 5; window 5; }; Knot example: system { rate-limit 200; # Each flow is allowed to 200 resp. per second rate-limit-slip 2; # Every other response is slipped (default) } Why not utilizing TTL related limitation in combination with source IP based limit?

40 based DoS protection Highly recommended to websites hosted on shared webhosting or VPS, but can be used on enterprise level as well. Relatively cheap and effective solution for most known DoS attacks. Take those risks on mind: not all services can be protected, in most cases used for HTTP/S only If you want HTTPS protection, SSL key pair will be sent to cloud provider and in fact they see unencrypted traffic (if not, your site can be subject of THC SSL DoS attack) you must limit access to website only from cloud IP addresses, otherwise attacker can bypass cloud protection and access website directly

41 based DoS protection

42 based DoS protection Largest known DDoS attack peaking at 300Gb/s of traffic (Spamhaus). You're simply unable to block this amount of traffic on your Internet pipe. This is the biggest benefit of cloud based DoS protection. Cloud services can also protect you against application based attacks (XSS, SQLi, CSRF, Flooding, Slow attacks, protocol violations,...) as described before in mode_security and thus looking like best choice. Don't forget that they can t limit all of them on your perimeter, that they have some limitations (often crucial) and can t protect your internal network or devices. Ask your ISP what he can do for you. What protections can offer (hopefully at least traffic blackholing - RTHB) and how to cooperate in case of DoS attack.

43 At the and I would like to recommend some providers Dedicated DDoS mitigation equipment: Arbor Networks, Cisco (CicoGuard), Toplayer, RioRey Cloud protection for websites/small companies: Incapsula, CloudFlare, Rivalhost, Imperva Enterprise level cloud protection: Akamai (DDoS Defender), Verisign, Prolexic, Gigenet, Staminus Security of your company is in your hands. DoS/DDoS is only one of many (often more dangerous) attacks.

2 Denial of Service Attacks : IT Security Sirindhorn International Institute of Technology Thammasat University Prepared by Steven Gordon on 13 August 2013 its335y13s2l06, Steve/Courses/2013/s2/its335/lectures/malicious.tex,

Firewalls Pehr Söderman KTH-CSC Pehrs@kth.se 1 Definition A firewall is a network device that separates two parts of a network, enforcing a policy for all traversing traffic. 2 Fundamental requirements

Security Technology White Paper Issue 01 Date 2012-10-30 HUAWEI TECHNOLOGIES CO., LTD. 2012. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without

Page 1 of 5 1. Introduction The present document explains about common attack scenarios to computer networks and describes with some examples the following features of the MilsGates: Protection against

CSE 3482 Introduction to Computer Security Denial of Service (DoS) Attacks Instructor: N. Vlajic, Winter 2015 Learning Objectives Upon completion of this material, you should be able to: Explain the basic

A Prolexic White Paper Firewalls: Limitations When Applied to DDoS Protection Introduction Firewalls are often used to restrict certain protocols during normal network situations and when Distributed Denial

PROFESSIONAL SECURITY SYSTEMS Security policy, active protection against network attacks and management of IDP Introduction Intrusion Detection and Prevention (IDP ) is a new generation of network security

A firewall is a software- or hardware-based network security system that allows or denies network traffic according to a set of rules. Firewalls can be categorized by their location on the network: A network-based

Seminar Computer Security DoS/DDoS attacks and botnets Hannes Korte Overview Introduction What is a Denial of Service attack? The distributed version The attacker's motivation Basics Bots and botnets Example

s (March 4, 2015) Abdou Illia Spring 2015 Test your knowledge Which of the following is true about firewalls? a) A firewall is a hardware device b) A firewall is a software program c) s could be hardware

Laboratory for Computer Security Education 1 Attack Lab: Attacks on TCP/IP Protocols Copyright c 2006-2010 Wenliang Du, Syracuse University. The development of this document is funded by the National Science

Denial Of Service The goal of a denial of service attack is to deny legitimate users access to a particular resource. An incident is considered an attack if a malicious user intentionally disrupts service

Firewall August, 2003 1 Firewall and Access Control This product also serves as an Internet firewall, not only does it provide a natural firewall function (Network Address Translation, NAT), but it also

Huawei Traffic Cleaning Solution Copyright Huawei Technologies Co., Ltd. 2011. All rights reserved. No part of this document may be reproduced or transmitted in any form or by any means without prior written

SonicOS Using SYN Flood Protection in SonicOS Enhanced Introduction This TechNote will describe SYN Flood protection can be activated on SonicWALL security appliance to protect internal networks. It will

ZEN LOAD BALANCER EE v3.04 DATASHEET The Load Balancing made easy OVERVIEW The global communication and the continuous growth of services provided through the Internet or local infrastructure require to

the Availability Digest @availabilitydig Surviving DNS DDoS Attacks November 2013 DDoS attacks are on the rise. A DDoS attack launches a massive amount of traffic to a website to overwhelm it to the point

Denial of Service Attacks Notes derived from Michael R. Grimaila s originals Denial Of Service The goal of a denial of service attack is to deny legitimate users access to a particular resource. An incident

WHITE PAPER FortiGate DoS Protection Block Malicious Traffic Before It Affects Critical Applications and Systems Abstract: Denial of Service (DoS) attacks have been a part of the internet landscape for

1. Firewall Configuration A firewall is a method of implementing common as well as user defined security policies in an effort to keep intruders out. Firewalls work by analyzing and filtering out IP packets

FortiDDoS DDoS Attack Mitigation Appliances Copyright Fortinet Inc. All rights reserved. What is a DDoS Attack? Flooding attack from compromised PCs run by a Botmaster The Botmaster s motivations may be

How Cisco IT Protects Against Distributed Denial of Service Attacks Cisco Guard provides added layer of protection for server properties with high business value. Cisco IT Case Study / < Security and VPN

How valuable DDoS mitigation hardware is for Layer 7 Sophisticated attacks Stop DDoS before they stop you! James Braunegg (Micron 21) What Is Distributed Denial of Service A Denial of Service attack (DoS)

INTRODUCTION TO FIREWALL SECURITY SESSION 1 Agenda Introduction to Firewalls Types of Firewalls Modes and Deployments Key Features in a Firewall Emerging Trends 2 Printed in USA. What Is a Firewall DMZ

White Paper A10 Thunder and AX Series Load Balancing Security Gateways June 2013 WP_LB FW 062013 Disclaimer This document does not create any express or implied warranty about A10 Networks or about its

CYBER ATTACKS EXPLAINED: PACKET CRAFTING Protect your FOSS-based IT infrastructure from packet crafting by learning more about it. In the previous articles in this series, we explored common infrastructure

Dos & DDoS Attack Signatures (note supplied by Steve Tonkovich of CAPTUS NETWORKS) Signature based IDS systems use these fingerprints to verify that an attack is taking place. The problem with this method

ZEN LOAD BALANCER EE v3.02 DATASHEET The Load Balancing made easy OVERVIEW The global communication and the continuous growth of services provided through the Internet or local infrastructure require to

White paper Combating DoS/DDoS Attacks Using Cyberoam Eliminating the DDoS Threat by Discouraging the Spread of Botnets www.cyberoam.com Introduction Denial of Service (DoS) and Distributed Denial of Service

Introduction to Mobile Access Gateway Installation This document describes the installation process for the Mobile Access Gateway (MAG), which is an enterprise integration component that provides a secure

MEASURING WORKLOAD PERFORMANCE IS THE INFRASTRUCTURE A PROBLEM? Ashutosh Shinde Performance Architect ashutosh_shinde@hotmail.com Validating if the workload generated by the load generating tools is applied